JWT `alg` taken from attacker-controlled header

**Status:** **verified not exploitable today** `jsonwebtoken` 10.4 blocks
cross-family confusion. Kept because the property rides a dependency invariant, not
a local assertion.
- **Fix (defense-in-depth):** derive expected `alg` from the stored JWK and pin it;
add `aud` validation.
- **Tool:** none.
Verification half — **open here** (`auth/mod.rs`):

- [ ] Pin `alg` from stored JWK
- [ ] Add `aud` validation + `kid` handling
Rotation half — **delegated to epic (Phase 3)**, do not duplicate:

- [x] ~~Add key rotation/revocation path~~ → tracked in issuer-registration epic

**blocked by #187**